https://latesthackingnews.com/wp-content/uploads/2018/11/bye.png
W1R3S is a vulnerable machine by design meant to help you polish your penetration test skills. On this box you are required to gain root access and read a flag located at /root directory. DHCP is enabled meaning the IP address will be allocated automatically. In my case, the machine allocated: 192.168.56.101 With the IP address, lets fire up nmap to enumerate the services running on this box:
From the scan, its likely there is a web application running.

Enumeration

Now let's enumerate directories and try discover any interesting paths.

I managed to get those two directories wordpress and administrator. I did a quick scan on the WordPress site using wp-scan but found nothing interesting. The administrator directory turns out to be the installation setup for Cuppa CMS.

http://192.168.56.101/administrator
Google tells me that CUPPA older versions suffer an LFI vulnerability.

Exploitation

check content of passwd file as follows:

Also lets try check the content of /etc/shadow

Lets try crack shadow and passwd file using John the Ripper The cracking completes in seconds.

Lets try ssh to the server as follows:

root@root:~# ssh w1r3s@192.168.56.101
 2 The authenticity of host '192.168.56.101 (192.168.56.101)' can't be established.
 3 ECDSA key fingerprint is SHA256:/3N0PzPMqtXlj9QWJFMbCufh2W95JylZ/oF82NkAAto.
 4 Are you sure you want to continue connecting (yes/no)? yes
 5 Warning: Permanently added '192.168.56.101' (ECDSA) to the list of known hosts.
 6 ----------------------
 7 Think this is the way?
 8 ----------------------
 9 Well,........possibly.
10 ----------------------
11 w1r3s@192.168.56.101's password: 
12 Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.13.0-36-generic x86_64)
13 
14  * Documentation:  https://help.ubuntu.com
15  * Management:     https://landscape.canonical.com
16  * Support:        https://ubuntu.com/advantage

Now since we are logged in as w1r3s lets look for ways to escalate privileges: To begin with, lets check what we can do at the moment:

Wow!! I can see that w1r3s is on the sudoers list.This means we can use sudo to run root commands:

This how I got the congratulations message:

Final thoughts:

W1R3S was pretty simple to hack but two key skills were required:

Ability to enumerate directories - This skill can save you a lot of time since in many cases you will find interesting paths which act as the entry points.
Ability to search exploits for running services-In this case, I managed to discover a CUPPA exploit by just a simple google search.Use of exploit DB and search engines like google can save you a lot of time.

Posted from my blog with SteemPress : https://latesthackingnews.com/2018/11/09/w1r3s-1-0-1-vulnhub-ctf-walkthrough/

Topics